Database/Control plane, storage & DevOps

Jenkins Script Security Plugin: sandbox does not check dynamically added methods, allowing escape

CVSS 7.5CVE-2026-92129Control plane, storage & DevOpscurated

Impact

Sandboxed Groovy scripts can call methods attached to a class at runtime without those calls being checked, so a user allowed only to run sandboxed Pipelines executes code outside the sandbox on the controller. This is a separate defect from the classpath double-download issue in the same advisory round and has its own fix. For a cluster whose Jenkins controller schedules GPU jobs and holds cluster credentials, a sandbox escape turns ordinary pipeline-authoring rights into controller-level code execution. Affects 1415.v9a_f9b_3a_c253d and earlier.

Who can reach it

Any authenticated Jenkins user with permission to define and run sandboxed scripts or Pipelines - the normal privilege level of a developer on a shared controller.

What to do

Update the Script Security Plugin to the version named in the Jenkins advisory and restart the controller. Sandbox rights cannot be relied on as a boundary until the update is in place, so restrict who can author Pipelines on controllers that hold fleet credentials.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-92129 https://www.jenkins.io/security/advisory/2026-09-16/#SECURITY-3977

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.